Location Proof for Privacy Preservation

Abstract

The non-transitory computer readable medium stores instructions implementing an application programming interface (API) that, when invoked by a software entity executing on a computing device, is configured to receive from the application an indication of a geographic location (304), obtain from an operating system of the computing device an indication of a general geographic area associated with a home location of the user, where the operating system prevents the software entity from accessing the indication of the general geographic area (306), and provide to the software entity an indication of whether the geographic location is within the general geographic area (308).

Description

[Technical Field]

[0001] The present disclosure relates to location verification, and more particularly to an application programming interface for verifying whether a user's home location corresponds to a particular geographic area without revealing the user's home location. [Background technology]

[0002] The background discussion provided herein is intended to provide a general context for the present disclosure. Work by the currently named inventors within the scope described in this background section, and aspects of this description that may not otherwise be considered prior art at the time of filing, are not admitted, expressly or impliedly, as prior art to the present disclosure.

[0003] Certain services with which a user device may interact apply location-based restrictions and, more generally, modify content or the presentation of content depending on the user device's current location. For example, music streaming and download services often restrict access to their digital catalogs of music based on the country from which a request for the content originates. Online video streaming services impose similar restrictions.

[0004] Additionally, providers of targeted digital advertisements (or "ads") often adjust the content, presentation format, presentation frequency, etc. based on the location of the device on which the content is presented. Advertisers can also use advertisement syndication, which allows them to expand their marketing reach by distributing their advertisements to additional partners, such as third-party online publishers that place the advertiser's text or image ads on web pages with content related to the ads. Advertisers can bid for placements based on how valuable the advertiser deems the placement. Bids can be based on certain aspects of the ad impressions, including the ad's click-through rate, and the geographic location to which the ad is served.

[0005] In some cases, users set up virtual private networks (VPNs) so that their computing devices acquire Internet Protocol (IP) addresses on remote networks, often within another country. In this way, a user currently located in country A who is permitted to access certain content only in country B can make their computing device appear to be operating in country B and thus gain access to the location-restricted content. Today, certain bad actors use VPNs to deceive users from a country where advertisers pay a relatively low price for the presentation of their content, by making them appear to be users from another country where advertisers pay a relatively high price for the presentation of their content. In some cases, portable devices can directly indicate to applications or scripts where the user's location is, but doing so would significantly reduce the level of privacy the user enjoys. On the other hand, restricting users' freedom to set up VPN connections would hinder various legitimate VPN-based services. Summary of the Invention [Means for solving the problem]

[0006] The disclosed application programming interface (API) enables an application running on a portable device to determine whether a particular geographic location is associated with the home location of the portable device without compromising privacy or interfering with VPN functionality.

[0007] An exemplary embodiment of these techniques is a non-transitory computer-readable medium having stored thereon instructions implementing an application programming interface (API), which, when invoked by a software entity executing on a computing device, is configured to: receive from the application an indication of a geographic location; obtain from an operating system of the computing device an indication of a general geographic area associated with a user's home location, wherein the operating system prevents the software entity from accessing the indication of the general geographic area; and provide to the software entity an indication of whether the geographic location is within the general geographic area.

[0008] Another exemplary embodiment of these techniques is a method implemented in an operating system of a portable device, the method including identifying a general geographic area associated with a home location of the portable device, storing an indicator indicating the general geographic area in a privileged area of ​​memory of the portable device, and restricting access to the indicator, the restricting including preventing software applications running on the portable device from accessing the indicator, and providing access to the indicator to an API exposed to the software application, the API configured to act on the indicator without revealing the indicator to the software application.

[0009] Yet another exemplary embodiment of these techniques is a portable device comprising one or more processors and a non-transitory computer-readable memory, the memory storing instructions executable on the one or more processors for implementing the above-described methods. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram of an exemplary computing environment and a portable device that implements techniques of the present disclosure for providing location proof without compromising user privacy. [Figure 2] FIG. 10 is a flow diagram of an example method that may be implemented in a third-party application for using a home location API to determine whether a specified location of a portable device is the home location of the portable device. [Figure 3] FIG. 10 illustrates a method that may be implemented in an API of the present disclosure for determining whether a landmark location is a home location of a portable device. [Figure 4] 2 illustrates schematically how the home location estimation module of FIG. 1 populates home location information fields in a privileged area of ​​memory. [Figure 5] FIG. 10 is a diagram illustrating generally how a multimedia application uses the home location API of the present disclosure to determine whether the multimedia application should provide particular location-restricted content via the user interface of a portable device. [Figure 6] FIG. 10 illustrates generally how an installer script uses the home location API of the present disclosure to provide an indication of whether a user who has installed a particular application is currently traveling. [Figure 7] FIG. 1 illustrates a schematic diagram of how a web browser uses the home location API of the present disclosure when a portable device uses a VPN to communicate with online services. [Figure 8] 1 is a flow diagram of an exemplary method that may be implemented in a portable device operating system for supporting location certification while preserving privacy. DETAILED DESCRIPTION OF THE INVENTION

[0011] Generally speaking, the API of the present disclosure enables an application running on a portable device to determine whether a particular geographic location is associated with the home location of the portable device. The geographic location that the application indicates to the API is an estimate of the portable device's current geographic location. The API compares the indicated geographic location with an indicator of the home location stored in a memory area inaccessible to the application. The API improves protection of user privacy by not revealing the home location to the application.

[0012] Referring initially to FIG. 1 , these techniques can be implemented in an exemplary portable computing device (or simply “portable device”) 102, such as a smartphone, a laptop computer, a tablet computer, a smartwatch, or any other general-purpose or special-purpose computing device. The portable device 102 operates within an environment 100 and can access, for example, location-restricted content 114 from a streaming server 104 and applications 116 from an application server 106 over a wide area network such as the Internet 110. Additionally, an advertising (“ad”) server 108 can interact with the portable device 102 and the servers 104 and 106 to provide advertisements in various formats (e.g., still images, interactive banners, audio segments, video segments, etc.) to the portable device 102. The ad server 108 can use a location-based bidding model 118 to determine minimum bids and price adjustments for ads based on geography.

[0013] In some cases, the portable device may operate within a virtual private network (VPN) by tunneling data through a VPN server 120. As discussed in more detail with reference to Figure 7, the VPN server 120 may present IP addresses to servers from which the portable device 102 requests content, such as the streaming server 104, the application server 106, and the ad server 108.

[0014] The hardware 130 of the portable device 102 includes one or more processors 132, non-transitory memory 134 readable by the processor 132, one or more positioning sensors 135, a user interface 136, and a network interface 138. The processor 132 may include one or more central processing units (CPUs), one or more graphics processing units (GPUs), dedicated hardware, etc. The memory 134, which may include any suitable non-transitory storage readable by the processor 132, includes privileged regions or areas 140 that are accessible to certain software components of the portable device 102 but inaccessible to other software components, such as third-party applications that a user may install on the portable device 102 and various third-party scripts and programs executed by native applications running on the portable device 102. The positioning sensor 135 may include a Global Positioning Services (GPS) module. The OS 160 may also use a wireless local area network (WLAN) interface, a wireless personal area network (WPAN) interface, and other wireless components operating as part of the network interface 138 to determine the location of the portable device 102 or to augment the readings of the GPS module. The user interface 136 may include a touch screen, a microphone, a speaker, and other suitable input and / or output devices.

[0015] The software 150 of the portable device 102 includes an operating system (OS) 160 and an OS API layer 170. The hardware 130, together with the OS 160 and the OS API layer 170, collectively define a platform capable of running a variety of native and non-native (e.g., third-party) applications. In addition to standard OS-level functionality, the OS 160 of the present disclosure may also include a home location estimation module 162 that, during operation, determines the home location of the portable device 102 and stores the determined home location information in a field 164 within the privileged area 140. The OS API layer 170 includes a home location API 172 that can access the field 164. Various software applications, programs, and scripts running within other applications (more generally, "software entities") can call the home location API 172 to check whether a particular location is associated with a home location, but generally do not have access to the privileged area 140, or specifically to the home location information 164.

[0016] In some implementations, the home location estimation module 162 operates, for example as a background task or daemon, to periodically access the positioning sensor 135 to estimate home location information and / or update the home location information in the field 164. The home location estimation module 162 may alternatively operate as a component of the home location API 172, and is not directly accessible to software entities that invoke the API 172.

[0017] Continuing to refer to FIG. 1 , application layer 180 may include, for example, multimedia application 182, social network application 184, and browser application 186. Application layer 180 may generally include any number of applications. In this exemplary configuration, multimedia application 182 and social network application 184 are non-native third-party applications developed by different respective third-party developers and adapted for OS 160. Browser application 186 in the example of FIG. 1 is a native application developed specifically for OS 160. However, browser application 186 may execute third-party scripts 190, which may be allowed to access some of the functionality of OS 160 and OS API layer 170.

[0018] 2, method 200 may be implemented in a third-party application, such as multimedia application 182. Method 200 begins at block 202, where the third-party application determines the current location of portable device 102. To this end, the application may access positioning sensors 135 or current location information stored by OS 160 when the user of portable device 102 has given the application permission to access these sensors. In other cases, the application determines the location of portable device 102 in block 202 based on an IP address, user input received directly via a form, referrer information, or another suitable source.

[0019] In block 204, the application invokes the home location API 172 to provide an indication of a geographic location that may be the location identified in block 202. For example, the home location API 172 may include a function having a format of isHome Location(inputLocation), which returns true if the specified location corresponds to the home location of the portable device 102 and false otherwise. The home location API 172 does not disclose the home location stored in field 164, regardless of the result of the execution of this function. In this way, the home location API 172 protects the user's privacy.

[0020] 3, the home location API 172 can support any desired level of granularity (or coarseness). Thus, for example, an application can specify a location as a set of GPS coordinates, and the home location API 172 returns true if the GPS coordinates are within the boundaries of the home country of the portable device 102. As another example, an application can identify the IP address of the portable device 102 and specify the town or city where the Internet service provider (ISP) for that Internet address is registered, and the home location API 172 returns true if the town or city is within the home country of the portable device 102.

[0021] In some implementations of the home location API 172, the interface includes an indicator of granularity, e.g., isHome Location(inputLocation, granularityLevel), where granularityLevel can be one of predefined values ​​in a predefined set such as {"continent," "country," "state," "city," etc.}. The granularityLevel parameter can alternatively be the size of the desired radius of accuracy, e.g., "100 miles."

[0022] In block 206, the application adjusts the presentation of content according to the output of the home location API 172 received in block 204. For example, the application may be a subscription-based movie streaming service, and when the home location API 172 returns false in block 204, the application disables playback and displays an error message saying, "Sorry, you are not in your home location." As another example, the application may provide a tuple (current country, "travel") or (current country, "home") to the ad server 108, and the ad server 108 may adjust the ad content for display on the portable device 102.

[0023] 3 illustrates an example method 300 that may be implemented in a suitable API, such as home location API 172. In block 302, the API determines a home location of the portable device and stores the determined home location in a privileged area 140 of memory 134. In some implementations, home location estimation module 162 estimates the home location using multiple readings of positioning sensor 135. For example, home location estimation module 162 may collect N samples over M days and calculate a geographic average. Home location estimation module 162 may perform the collection and estimation periodically, for example, every 12 hours, every 24 hours, or every 72 hours.

[0024] Sensor data can include GPS coordinates, IP address information for the portable device 102, the IP address of the access point (AP) of the WLAN on which the portable device 102 operates, etc. As another example, the API can collect samples at night because the user is more likely to be at home at that time. According to at least some implementations of the API, the user indicates that the API is allowed to obtain this data by exercising certain controls or installing certain software. In yet another implementation, the API explicitly queries the user regarding their home location.

[0025] The API can store the home location as home location information 164 at any desired level of granularity. In various implementations, the API can store the home location at the level of a continent (e.g., "Asia," "North America"), a large geographic region (e.g., "Eastern Europe," "North Africa"), a country (e.g., "Japan," "France"), a state (e.g., "Bihar," "Alabama"), or a city or town (e.g., "London," "San Francisco"). In other implementations, the API can store the home location as an S2 cell or set of S2 cells, which is a projection of the spherical surface of the Earth onto a two-dimensional coordinate system at any appropriate zoom level. Additionally, the API can, in some cases, store the home location as a set of GPS coordinates.

[0026] Next, in block 304, the API receives a query indicating the estimated current location of the portable device 102 and, in some implementations, the desired level of granularity (see the discussion of block 204 above). As discussed above, the API may be exposed to a variety of third-party applications, scripts, or other software entities.

[0027] In block 306, the API compares the location received in block 304 with the home location. To this end, the API can obtain an indicator indicating a general geographic area associated with home location information 164. For example, home location information 164 can store an indicator indicating a city, and the application can call the API with the granularity level set to “country.” The API can use any suitable technique, such as converting both locations to S2 cells and traversing the S2 cell tree to determine whether the S2 cell of the identified location is within the S2 cell of the home location. Then, in block 308, the API generates a proof value, such as true or false, based on the comparison.

[0028] Although the API in this exemplary implementation is specifically configured to compare a location specified by a software entity with a home location stored in a privileged area of ​​memory, the API may generally be configured to perform certain appropriate operations on the home location without revealing the home location stored in a privileged area of ​​memory to the entity invoking the API.

[0029] In some implementations, the API prevents a software entity from frequently invoking the API within a certain predetermined time period in an attempt to iterate through multiple possibilities and thereby identify a home location. For example, the API may limit the number of times a software entity invokes the API per day or impose a lockout period after returning false. In some implementations, the API returns an error code in response to determining that the software entity has invoked the API more than N times (e.g., 3 times, 5 times) within a predetermined time period (e.g., 12 hours, 24 hours).

[0030] For further clarity, some example scenarios in which an application calls the home location 172 will now be discussed with reference to FIGS.

[0031] 4 , the home location estimation module 162 in a scenario 400 may obtain one or more readings 402 from one or more of the positioning sensor 135, the user interface 136, or the network interface 138. In one such scenario, the home location estimation module 162 obtains multiple GPS readings from the positioning sensor 135 for a particular time period, clusters the readings, and determines the geometric center of the largest cluster. The home location estimation module 162 then identifies an S2 cell at a low level of granularity (e.g., country) and stores 404 the name of the identified country corresponding to this relatively coarse S2 cell in field 164. In another scenario, the location estimation module 162 obtains multiple readings of an IP address assigned to the network interface 138 over a particular time period and identifies the relatively coarse S2 cell, as discussed above. In yet another exemplary scenario, the home location estimation module 162 prompts the user via the user interface 136 and stores 404 the specified country in field 164. The home location estimation module 162 may also implement any suitable combination of these techniques.

[0032] 5 next illustrates an exemplary scenario 500 in which a multimedia application 182 uses the home location API 172 to determine whether the multimedia application 182 should enable playback of particular content. The multimedia application 182 in this case may be restricted to providing streaming media only if the user is currently in their home country.

[0033] Operation 501 corresponds to multimedia application 182 determining the current location of portable device 102 by obtaining readings from positioning sensor 135, subject to user permission 510. More specifically, OS 160 may require the user to provide permission for multimedia application 182 to obtain readings from positioning sensor 135 before granting multimedia application 182 access to positioning sensor 135. current The OS 160 may check the permissions 510, for example, when the multimedia application 182 is installed or when it is run.

[0034] The multimedia application 182 may be connected to the identified location LOC current to the home location API 172, which in turn retrieves the home location information from field 164. The multimedia application 182 in this example scenario returns 503 the value "true" to the multimedia application 182 to indicate that the portable device 102 is currently operating within its home location. The multimedia application 182 responds by enabling playback.

[0035] 6 illustrates generally how an installer script 602 in a scenario 600 uses the home location API 172 to provide an indication of whether a user who installed a particular application 604 is in their home country or is currently traveling. A particular content provider may value an installation differently depending on whether the user is a visitor to the country, and the installer script 602 reports to the provider of the application 604 or another third party whether the installation occurred within the home country of the portable device 102. As a more specific example, the installer script 602 may report to the provider of the application 604 the tuple {US, home} or {US, traveling}, respectively, depending on whether the portable device 102 belongs to a user residing in the US or a user visiting the US.

[0036] In a similar manner, an advertisement provider may value impressions (or instances in which an advertisement is displayed via a user interface) differently in a particular country depending on whether the user operating portable device 102 resides in the country or is visiting the country. A script generally similar to installer script 602 may report tuples such as {Japan, Travel} or {India, Home} to an advertisement server for a particular campaign. The advertisement server may use this information to run different auctions (e.g., specify different bid amounts) for the {Country, Home} and {Country, Travel} situations.

[0037] 6, installer script 602 executes within the environment of browser application 186. More specifically, installer script 602 may include instructions written in a scripting language, such as Javascript, that is executable by browser application 186. The installer script provides 611 a country indicator (e.g., "US") to browser application 186, which then calls 612 home location API 172 with the country indicator. In this example scenario, home location 172 returns "false," and the browser application reports 614 to installer script 602 that the user is traveling within the specified country.

[0038] 7 next illustrates schematically how a browser application 186 can use the home location API 172 when accessing location-restricted content 114. The user in this case has set up a VPN connection with the streaming server 104 via the VPN server 120. Traffic between the portable device 102 and the server 104 accordingly proceeds 702 via the VPN server or VPN host 120. As a result, the browser application 186 and / or software components operating within the environment of the browser application 186 (e.g., Hypertext Markup Language (HTML) instructions, plug-ins, and scripts, instructions executing on a virtual platform) may determine that the current location of the portable device is the location LOC of the VPN server 120, which may be operating in a different country or continent than the portable device 102. VPN Server When the streaming server 104 restricts access to the content 114 to a particular country, the user may select a VPN server 120 that operates within this country and thus gain access to the restricted content.

[0039] Browser application 186 is LOC VPN Serveras a parameter. The home location API 172 returns 716 "false" in this example scenario because the location stored in field 164 does not correspond to the indicated location. In some scenarios, the streaming server 104 may provide a software component along with the location-restricted content 114. After the home location API 172 returns "false," the software component may provide an error message, such as "This content cannot be played in your region." Alternatively, the browser application 186 may provide the results of the call to the home location API 172 to the streaming server 104, which may provide the error message in a streaming format with the location-restricted content 114.

[0040] 8 illustrates an exemplary method 800 that may be implemented by an operating system, such as OS 160, for supporting location certification functionality. At block 802, the operating system determines the home location of the portable device. As discussed above with reference to block 302 of FIG. 3, a component of the OS, such as home location estimation module 162, may use one or more readings from positioning sensor 135, user interface 136, and / or network interface 138.

[0041] In block 804, the operating system stores an indicator of the identified home location in a privileged area of ​​memory, such as field 164. The operating system may store the indicator at any desired level of granularity. Next, in blocks 806 and 808, the operating system selectively restricts access to the stored indicator. Specifically, the operating system grants read access to the indicator only to certain software entities (e.g., home location API 172) (block 806) and prevents other software entities (e.g., multimedia application 182, social network application 184, browser application 186, third-party script 190) from accessing the indicator (block 808). In this way, the operating system requires software entities to access the stored indicator of home location only indirectly and only through home location API 172.

[0042] The following additional considerations apply to the preceding discussion:

[0043] Certain embodiments are described in this disclosure as including logic or several components or modules. The modules may be software modules (e.g., code stored on a non-transitory machine-readable medium) or hardware modules. A hardware module is a tangible unit capable of performing specific operations and may be configured or arranged in a particular manner. A hardware module may comprise dedicated circuitry or logic that is permanently configured to perform specific operations (e.g., as a dedicated processor such as a field programmable gate array (FPGA) or application-specific integrated circuit (ASIC)). A hardware module may also comprise programmable logic or circuitry (e.g., contained within a general-purpose processor or other programmable processor) that is temporarily configured by software to perform specific operations. The decision of whether to implement a hardware module as dedicated, permanently configured circuitry or as temporarily configured circuitry (e.g., configured by software) may be determined by cost and time considerations.

[0044] When implemented as software, the techniques may be provided as part of an operating system, a library used by multiple applications, a specific software application, etc. The software may be executed by one or more general-purpose processors or one or more special-purpose processors. [Explanation of symbols]

[0045] 100 Environment 102 Portable computing devices, portable devices 104 Streaming Server 106 Application Server 108 Ad Server, Ad Server 110 Internet 114 Location-Restricted Content 116 Applications 118 Location-Based Bidding Model 120 VPN servers, VPN hosts 130 Hardware 132 processors 134 Non-transient memory 135 Positioning Sensor 136 User Interface 138 network interfaces 140 Privileged territory, privileged area 150 Software 160 Operating System (OS) 162 Home Location Estimation Module 164 Field, Home Location Information 170 OS API Layer 172 Home Location API, Home Location 180 Application Layer 182 Multimedia Applications 184 Social Network Applications 186 Browser Applications 190 Third-Party Scripts 200 ways 300 ways 400 Scenarios 402 reading 500 Scenarios 510 User Authorization 600 scenarios 602 Installer Script 604 Applications 800 ways

Claims

1. A computer-readable storage medium storing instructions for implementing an application programming interface (API) on a portable device, the API, when invoked by a software application running on the portable device, receiving from the software application an indication of the current geographic location of the portable device as determined by a positioning sensor of the portable device; obtaining, from an operating system of the portable device, an indication of a general geographic area associated with a home location of the portable device, the home location being a position estimated using values ​​collected by the positioning sensor for a specified period of time, the general geographic area being an indication of the home location at a level of granularity specified by the software application, the operating system denying the software application access to a privileged area of ​​memory of the portable device in which the indication of the general geographic area is stored; providing the software application with an indication of whether the geographic location is within the general geographic area; receiving a roughness level from the software application; comparing the geographic location to the general geographic area according to the coarseness level; configured to: and when, based on the comparison, the geographic location is not within the general geographic area, the software application disables playback of the streaming service on the portable device. A computer-readable storage medium.

2. 2. The computer-readable storage medium of claim 1, wherein the API is configured to access the privileged area of ​​the memory of the portable device to obtain the indication indicating the general geographic area, the privileged area of ​​the memory being inaccessible to the software application.

3. 3. The computer-readable storage medium of claim 1, wherein the general geographic area is identified based on periodic readings of one or more sensors of the portable device.

4. 3. The computer-readable storage medium of claim 1, wherein the general geographic area is received from a user via a user interface of the portable device.

5. The computer-readable storage medium of claim 1, wherein the coarseness level corresponds to one of a country or a continent.

6. The API: identifying an S2 cell based on the indicia indicating the geographic location; If the identified S2 cell is within or coincides with an S2 cell corresponding to the general geographic area associated with the user's home location, providing the indication that the geographic location is within the general geographic area; 6. The computer-readable storage medium of claim 1, further configured to:

7. The API: returning an error code in response to determining that the software application has invoked the API more than N times during a predetermined time period.

7. The computer-readable storage medium of claim 1, further configured to:

8. 8. The computer-readable storage medium of claim 1, wherein the software application is a non-native software application configured to run on the operating system of the portable device.

9. 9. The computer-readable storage medium of claim 1, wherein the software application is a script configured to run within a native browsing application on the portable device.

10. 1. A method implemented in an operating system of a portable device, comprising: determining, by one or more processors, a general geographic area associated with a home location of the portable device, the home location being an estimated position using values ​​collected by a positioning sensor for a specified period of time, the general geographic area being a representation of the home location at a level of granularity specified by a software application; storing, by the one or more processors, an indicia indicating the general geographic area in a privileged area of ​​memory of the portable device; restricting, by the one or more processors, access rights to the privileged area of ​​the memory in which the indicator is stored; preventing, by the one or more processors, software applications running on the portable device from having access to the indicator; granting, by the one or more processors, access to the indicator to an API exposed to the software application, the API configured to act on the indicator without revealing the indicator to the software application; the API receiving a roughness level from the software application; and the API comparing the geographic location to the general geographic area according to the coarseness level; and when it is determined based on the comparison that the home location is not within the general geographic area, the software application disables playback of streaming services on the portable device. method.

11. The method of claim 10 , wherein identifying the general geographic area comprises taking periodic readings of one or more sensors of the portable device.

12. The method of claim 10 , wherein identifying the general geographic area comprises receiving, via a user interface of the portable device, an indication of the general geographic area.

13. one or more processors; a computer-readable storage medium storing instructions that, when executed by the one or more processors, cause the portable device to perform the method of any one of claims 10 to 12; and A portable device comprising:

Images